#25164: The django.contrib.auth.views.login does not observe authentication via
RemoteUserMiddleware
------------------------------+--------------------------------------
Reporter: adelton | Owner: nobody
Type: Bug | Status: closed
Component: contrib.auth | Version: master
Severity: Normal | Resolution: wontfix
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+--------------------------------------
Comment (by adelton):
There are two things that I believe that view could do better: be more
explicit that the user is already authentication and that re-
authentication will happen (and we will need to verify if re-logging on
that view will actually change the authentication user, overriding the
identity that came from `RemoteUserMiddleware`). And add a mechanism to
know that the `RemoteUserMiddleware` (and especially
`PersistentRemoteUserMiddleware`) authentication just happened for the
first time in the current HTTP request, in which case I'd really assume
that the expected behaviour is to just accept that external authentication
and skip the logon page.
I will try to come up with some code which would address those, it might
just take me some time due to other work.
Thank you,
Jan
--
Ticket URL: <https://code.djangoproject.com/ticket/25164#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.00a52bb9310abfece0867299c35376f4%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
